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TRANSITORY RECORD 
CG, 


| am interested on your thoughts on the attached paper. This was found online at the address noted at the top of the 
paper (mediafire.com). Looks like the argument in this paper is largely supported by activity likely caused by our 
investigation and other acts by a jeeeeenieneimemenenelll | would like your technical opinion 
on this paper. Is this related to the and do we have information which can you help explain the ‘new’ trump email 


domain now pointed at the original server? 


As Always, Thank you for the great work on this, 
-Ryan 
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Subject to Protective Order 


Below is from: 


http://www.mediafire.com/file/qc68ptSk6wn9f64/gdd.zi 


Global DNS Data 


This site provides neutral, factual DNS data, showing how networks communicate 
with each other. 


1. Lookups for maill.trump-email.com 


This data shows communications between Trump, Spectrum, and Russian Alfa Bank 
networks. 


Network Diagram Scenario 
This diagram (png file: 183769 bytes) shows how parties communicated via email using 


different servers. 
3. Check back for more 
4. Leave questions at: tea. leaves@tuta.io 


N 


Summary: 


e Trump and Russia's largest private bank communicate via hidden 
server since at least 2016 May 

e Confronted with questions by NYT reporter, Alfa Bank denies any 
relationship 

e Hidden server belonging to Trump then disappears (no one but Alfa 
Bank was asked) 

e Deleted host name maill.Trump-Email.com is replaced with 
trump 1.contact-client.com 

e Russian Alfa Bank is the first host seen to contact the new trump]. 
server 


Comments: 


Trump's FEC filings fail to disclose any foreign bank account in Russia or 
relationship with the Russian Alfa Bank. 


Network logs show a distinctively human pattern of communications 
between a hidden server dedicated for use by the Trump Organization and 
the Russian financial company Alfa Bank, which has close ties to the 


Kremlin. Trumpcampaign advisors also have relationships with Alfa Bank 
and related Alfa-Group / LetterOne. 
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The other frequent connection to Trump's hidden server with the same 
distinctive human pattern is Spectrum Health, a Michigan hospital with close 
ties to the DeVos family (http://www.spectrumhealth.org/locations/helen- 
devos-childrens-hospital). The Devos family founded Amway / Alticor 
which operates in Russia including transactions with Alfa Bank such 

as buying insurance for 800 Alticor employees from Alfa Bank's insurance 
subsidiary. The Devos family has given millions of dollars in the past few 
months to conservative super PACs (www.fec.gov). One member of 

the Devos family was a founder of Blackwater. 


Trump's hidden server appears to be a specially configured outbound email 
server. The email server type normally would handle outbound bulk 
advertising or transactional mail for a large enterprise to customers, 
powerful enough to deliver millions of emails per day. ( 
http://www.marketerspublishinggroup.com/PMTA-UsersGuide-4.0.pdf). 
Different in every way from traffic seen on adjacent servers managed by the 
same server company, this specially configured server has been exclusively 
corresponding with Alfa-Bank and Spectrum since at least May 2016 with a 
cadence and rate of a human conversation. See the graph of the connections 
here. 


The stealth server has had two different names: 


mail! .Trump-Email.com (zone deleted on Friday, 2016-Sept-23 after the 
Russian Alfa-Bank was asked by the New York Times to explain the 
communications) 


and on 2016-Sept-27 a new name showed up: 
trump 1.contact-client.com 


When a reporter from the New York Times (NYT) asked the Russian Alfa 
Bank for comment about the apparent communications, Alfa Bank denied 
any relationship with the Trump Organization. The NYT reporter 
communicated with no one other than the Russian Alfa Bank - yet the 
Trump-Email.com domain began showing signs of panicked reconfiguration 
within hours of the New York Times asking the Russian Alfa Bank why they 
were making connections to Trump-Email.com. While no errors were seen 
in all the months prior to this question from the reporter - suddenly errors 
appeared. Two of the authoritative name server hosts deleted the zone, while 
the third authoritative just erased the IP from the configuration line and 
continued to answer authoritatively. This mistake can still be demonstrated 
at the time of this writing. 


The Trump Organization deleted the Trump-Email.com zone shortly before 
10 AM Eastern US time on Friday Sept 23rd after the NYT reporter called 


FBI-DWS-01-0001084 


SCO_FBIPROD_004848 
SCO-006369 
Subject to Protective Order 


Alfa Bank. This suggests a cover-up attempt by Trump and Alfa Bank. It 
suggests communication from Alfa Bank warning the Trump Organization 
to take action to remove the evidence of the hidden server domain, 
maill.Trump-Email.com. 


The physical server itself was never changed; just the hostname 
maill.Trump-Email.com stopped pointing to that physical server and the 
hostname was effectively deleted from the global Domain Name System 
(DNS). 


By September 27th 2016, the Trump Organization had created a new host 
trump! .contact-client.com pointing to the exact same physical server 
previously operating as maill.Trump-Email.com. 


The Russian Alfa Bank was the first to contact the newly renamed host, 
strongly indicating again that Trump and Alfa Bank are coordinating with 
each other and have a very close relationship. After this discovery, they are 
likely moving conversations to a new channel. 


Trump has a bank account with the Russian Alfa Bank, which may explain 
the need for hidden server communications. Alfa Bank / Alfa Group / 
LetterOne has expressed interest in investing billions in US health care 
companies, which could include Michigan's Spectrum Health or could be 
regarding the financial relationships Amway/Alticor has with the Russian 
Alfa Bank insurance company. 


F.A.Q. 


Are you sure the Trump-Email.com domain really belongs to the 
Trump Organization? 


We have 100% confidence. You can verify the complete whois record by 
going to the Godaddy.com website and clicking on WHOIS. While whois 
records can be forged, we also judge authenticity based on the resources 
used by each domain name. A very detailed analysis has been made of 
thousands of Trump Organization domain names, vendors and hosting 
resources, confirming that this domain without question belongs in the same 


group. 
Excerpt from Trump-Email.com whois record: 


Registrant Name: Trump Orgainzation 

Registrant Organization: Trump Orgainzation 
Registrant Street: 725 Fifth Avenue 

Registrant City: New York 

Registrant State/Province: New York Registrant 
State/Province: New York 
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Registrant Postal Code: 10022 
Registrant Country: US Registrant Country: US 
Registrant Phone: +1.2128322000 
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maill. Trump-Email.com 
le Accepts emad submissions only kom authonzed | 
users. Authentication methods avaiable include 
| SMTP AUTH w of wio network ACL such as IP 
| address restrechons. 
* Sends OUTBOUND mai, to one or more address 
spected in the submission 
. Typically used for high volume sends, designed to 
omonably send midons per day per IP address 
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